There are a variety of defence strategies for backdoor attacks ranging from data level to model level but with a focus on the classification models in centralized training. Data level defences mainly include two perspectives: 1) Detect the trigger pattern and either eliminate it from the data or add a trigger blocker to decrease the contribution of the backdoor during training the DL model [1]}. 2) Perform a serious of data argumentation (e.g., shrinking, flipping) before fed the data into the model [2]}, [3]}. This is because transitional backdoor attack is sensitive to the patter of the trigger and the location of the backdoor patch [4]}.
